Data Processing Agreement

01Roles

The Customer is the controller and FoodSafe Formulate is the processor of personal data within Customer Data.

02Scope of processing

Subject matter and duration: provision of the Service for the term of the Subscription plus the deletion period.

Nature and purpose: hosting, storage, calculation, display, export, backup, support and security of Customer Data.

• Data subjects: the Customer's staff, Authorised Users, consultants, supplier contacts and any individuals named in records.
• Categories of data: names, job roles, business contact details, signatures/approval records, training and HACCP monitoring entries, and any personal data the Customer chooses to upload.
• Special category data: not required by the Service. The Customer should not upload health or other special category data unless strictly necessary and lawful.

03Our obligations

FoodSafe Formulate will:

• process personal data only on the Customer's documented instructions, including these terms and in-product actions;
• ensure staff with access are bound by confidentiality;
• implement appropriate technical and organisational measures (Article 32), described on our Security page;
• assist the Customer in responding to data subject requests;
• assist with data protection impact assessments and consultations with the ICO where relevant;
• notify the Customer without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting Customer Data;
• delete or return personal data at the end of the Service, unless law requires retention;
• make available information needed to demonstrate compliance and allow reasonable audits, on 30 days' notice and no more than once a year unless a breach has occurred.

04Sub-processors

The Customer gives general authorisation for the sub-processors listed on our Sub-processors page. We will give at least 30 days' notice of new sub-processors, during which the Customer may object on reasonable data protection grounds. We impose equivalent data protection terms on each sub-processor and remain responsible for their performance.

05International transfers

We will not transfer personal data outside the UK unless protected by adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to EU Standard Contractual Clauses.

06Customer obligations

The Customer warrants it has a lawful basis for the personal data it uploads, has given individuals any required privacy information, and will configure user roles appropriately.

07Liability

Each party's liability under this DPA is subject to the limitations in the Terms of Service, except where the law does not permit limitation.

08Requesting a signed copy

If your organisation needs a countersigned DPA, email legal@foodsafeformulate.co.uk.